Drag
loader

Contact info

Email
hello@ferressystems.com.au
Based in
Melbourne, Victoria

Follow us

Talk to the team
Talk to the team
All industries // ACCOUNTING PRACTICES

You hold the identity documents for every client you have

Managed security and IT for Australian accounting practices, built around tax file numbers, agent portal access and the fraud that targets both.

Talk to us about your practice
 Free, no access needed See what you are exposing
// WHAT YOU ARE ACTUALLY UP AGAINST

The obligations and pressures, in plain English

The specific pressures on accounting practices in Australia, with the regulator or source named. Where a duty comes from a contract or an insurer rather than a statute, it says so.

01

Tax file numbers carry their own legal regime

The Privacy (Tax File Number) Rule 2015 sets specific requirements for how tax file number recipients collect, use, store and dispose of TFNs, on top of the Privacy Act. A practice holds them for most clients and often for their families, and that concentration of identity data is part of what makes practices a target.

The Privacy (Tax File Number) Rule 2015

02

Your agent portal access is the real prize

An attacker who reaches your practice does not just get your data. They may get a route to lodge, amend and redirect on behalf of the clients you act for. The ATO has warned tax practitioners that their online services access is targeted for this reason.

03

The Code of Professional Conduct includes confidentiality

The Tax Practitioners Board's Code of Professional Conduct says that, unless you have a legal duty to, you must not disclose information about a client's affairs to a third party without the client's permission. The Code does not list technical controls. A practice that cannot say who has access to client files, or whether anyone would notice them being taken, is poorly placed to show how it protects that confidentiality.

The TPB Code of Professional Conduct

04

Everything happens in a compressed window

The workload is not evenly spread across the year, and lodgement deadlines are public. An urgent email during the busiest fortnight is more likely to be acted on quickly than the same email in a quiet month.

// WHAT ACTUALLY GOES WRONG

Four patterns we keep seeing

Credential theft into the portal

A phished set of credentials without multi-factor authentication is the entire attack. It requires little technical sophistication and it is one of the most common ways practices are compromised.

The refund redirection

Bank details altered on lodgements, usually in small numbers across many clients so that nothing looks anomalous until reconciliation.

Client data in email forever

Practices accumulate years of identity documents, statements and TFNs in mailboxes because that is where clients sent them. One compromised mailbox exposes all of it.

Seasonal staff, permanent access

Contractors brought in for lodgement season are given access quickly and offboarded slowly, or not at all.

// FROM THE FIELD

The Tuesday night an accounting firm slept through

A workstation started talking to a known malicious host at 3:08am. By 7:58am the write-up was in the partner's inbox and the day ran like any other. Nobody was woken up.

Read the write-up
// WHERE TO START

What matters most for accounting practices, in order

01

Managed Security

Around the clock monitoring of the identities and mailboxes that portal access depends on, with real response when something is confirmed.

 02

Security Baseline Assessment

Three business days, read-only, with findings mapped to the relevant Essential Eight controls. It answers who can reach what in your Microsoft 365 tenant.

 03

Cybersecurity Governance and Compliance

Policies, a tested incident response plan and staff training aimed at the phishing that arrives around lodgement deadlines.

 04

IT Projects and Microsoft 365

Getting off the ageing on-premise server that holds the practice files, without breaking anything at month end.
// ASKED BY ACCOUNTING CLIENTS

Frequently asked questions

No single control is enough, but multi-factor authentication is one of the most valuable a practice can turn on. It blocks a large share of attacks that rely on a stolen password. Phishing kits that relay a sign-in in real time can get past weaker methods such as SMS codes, which is why the method matters and why conditional access and sign-in monitoring sit alongside it. Then look at the rest of the Essential Eight.

The Essential Eight explained

If the Notifiable Data Breaches scheme applies to your practice, a suspected breach has to be assessed promptly, and within 30 days at most. The scheme covers organisations under the Privacy Act, and it also covers tax file number information held by TFN recipients. A breach is notifiable where there is unauthorised access to, disclosure of or loss of personal information that is likely to result in serious harm to someone, and remedial action has not prevented that harm. Exposed TFNs and identity documents weigh heavily in that assessment. If it is notifiable, you tell the affected clients and the OAIC.

The OAIC on when to report a data breach

You may not need to change providers at all. A general IT provider keeps things working, which is a real job, and security monitoring is a different one. Some practices keep their existing arrangement and add managed security alongside it.

Badly implemented ones will, which is why timing and design matter. We do not roll out anything disruptive into your busiest fortnight. Conditional access can be configured so that someone signing in normally from a known, compliant device sees little or no extra prompting, and that configuration is tested before lodgement season rather than during it.

Working nationally from Melbourne, Victoria. How the national service works, or see the other sectors we write about.

Tell us what you are protecting.

Get in touch